The invention relates to a system control apparatus for performing control, status monitoring; and maintenance of a computer system of high reliability in an on-line manner. More particularly, the invention relates to a system control apparatus having a double construction in which a system is not stopped by the double construction.
Hitherto, in a large computer system, there is provided a system control apparatus for performing control of a power source of the computer system and activation and stop of component equipment, status monitoring, and further maintenance in an on-line manner. In recent years, the development of a computer system of a high reliability which can avoid a stop of the system by multiplexing computer functions in parallel has progressed. With respect to a system control apparatus which is used for such a high reliable computer system, it is also considered to construct the system control apparatus so as to have a double construction so as not to cause the stop of the computer system by the stop of the system control apparatus.
According to the double construction of the conventional system control apparatus, one system control apparatus is made operative as a daily-use apparatus and the other system control apparatus is set to a standby state as a spare apparatus. If an abnormality occurs in the daily-use apparatus, the apparatus is switched to the spare apparatus and the processes are taken over. In such a system control apparatus with a double construction (using the daily-use apparatus and the spare apparatus is, when an abnormality occurs in the daily-use apparatus, in order to activate the spare apparatus, various information regarding the control, status monitor, and maintenance of the computer system which are possessed by the daily-use apparatus which caused the abnormality has to be taken over as they are. Therefore, after the daily-use apparatus is stopped due to an abnormality, the taking-over of the various kinds of information cannot be guaranteed. Eventually, the computer system is stopped, the spare apparatus is used, and the computer system has to be activated from the beginning. As a method of solving the above problem, there is a method of a double construction in which two system control apparatuses are operated in parallel so as to execute exactly the same processes. In this case, even if one system control apparatus stops, since the other system control apparatus is normally operating, the the computer system is not caused to stop. However, in the two system control apparatuses which simultaneously operate in parallel, when a difference occurs in the information regarding the control, status monitoring, and maintenance of the computer system, it is unknown that the control, status monitoring, maintenance, and the like of the computer system should be executed on the basis of which information. In this case, a method of judging that the computer system has mainly been operated on the basis of the information of which one of the two system control apparatuses and using the information that is considered to be correct is also considered. Since a probability about whether the information is correct or not is fifty--fifty, there is a problem such that the reliability due to the double construction cannot be sufficiently guaranteed.